At SaaS Platform, security, tenant data isolation, and privacy are foundational. This document outlines our security policies, vulnerability disclosure procedures, and response SLAs.

We issue security patches and updates for the following active release branches:

DO NOT report security vulnerabilities, multi-tenant isolation breaches, or secret leaks via public GitHub issues.

If you discover a security vulnerability or multi-tenant boundary flaw:

1. Email our dedicated security team at security@saasplatform.dev.
2. Include standard technical context:
   • Type of issue (e.g., Cross-Tenant Access, RBAC Bypass, SQL Injection, JWT Flaw).
   • Affected module (auth, workspace, platform, common).
   • Step-by-step proof-of-concept (PoC) or script.
   • Impact assessment (potential data access or escalation path).

We adhere to standard coordinated vulnerability disclosure timelines:

The platform maintains security defense-in-depth across multiple layers:

1. Workspace Multi-Tenancy Isolation: Every tenant request carries a validated workspace_id in context. Database queries MUST explicitly filter by workspace scope.
2. RBAC + PBAC Policy Enforcement: Handlers evaluate EnforcePermission(ctx, workspaceID, permission) prior to executing business logic.
3. Separation of Duties (SoD): High-privilege actions (such as transferring workspace ownership or modifying global security policies) enforce mandatory dual-control checks.
4. Secret Protection: API keys, DB passwords, and JWT signing keys are ingested strictly via environment variables (.env.example). Hardcoding credentials in source code is blocked by CI hooks.